Information security risk management
The methodology used may include an estimate of costs and
benefits, legal requirements, social, economic and environmental aspects, the
concerns of the interested parties in the organization, priorities and other
additional variables, as necessary and of interest in each case. particular.
The results of the information security risk assessment provide
important help to determine the most appropriate management decisions in the
treatment, in the use of resources and in the priorities that are recommended
to be applied for the optimal management of security risks. of information at
all times and in relation to other business needs.
One of the results that most surprises organizations when
developing the first evaluations is the finding that there are excessive
resources dedicated to the protection of some minor assets or controls that,
although they once were, are no longer relevant to the organization and they
maintain a consumption and dedication of resources that are clearly avoidable,
and that provides a potential source of savings.
For an organization to develop its own methodology and
consider all relevant aspects in this task, the international standard ISO /
IEC 31000 exists as the most direct help to undertake this work, and which
provides guidance on management activities, including advice on risk
assessment, risk treatment, risk acceptance, risk communication, risk control
and risk review.
It is pertinent to clarify that ISO / IEC 31000 , as well as
in the case of other documents related to methodologies for risk assessment in
organizations (Magerit, ISO 27005, etc.), serve as help documents to implement
the assessment process and treatment of information security risks. Therefore,
each organization must define and formalize the methodology that best suits its
needs and resources.
In this sense, the frequent error of introducing, in the
implementation phase, more complex methodologies and with a more laborious
development than what the organization can really maintain usually occurs,
condemning the possibility of maintenance in the short-medium term (less than a
year in many cases).
Maintenance and improvement of the effectiveness of the ISMS
An organization needs to maintain and improve the ISMS through monitoring and evaluation of its
performance and in consideration of the organizational policy and stated
objectives.
Similar to other activities relevant to the organization
(such as planning, economic or financial), the results of the security
management must be reported to the senior management involved in the ISMS for
review. This review of the ISMS allows to provide evidence of the development
of the validation, verification and traceability actions of those corrective,
preventive and improvement actions, and based on the records and monitoring of
the various areas considered in the scope of interest within the ISMS,
including monitoring the performance and effectiveness of the information
security controls that are in place.
Success factors
There are a large number of factors that must be considered
fundamental for the proper implementation of an ISMS and allow an organization
to meet its business objectives.
Here are some of the most important critical success factors
to consider:
• Obtain an
understanding of the context of the organization and the elements that can
affect information security .
• Obtain
all interested parties and their requirements regarding information security.
• Obtain
the applicable legislation and information security requirements.
• Security
policy, objectives and activities of the ISMS in harmony with those
corresponding to the business.
• The
approach and framework used for the design, execution, supervision, maintenance
and improvement of information security must be consistent with the
organizational culture .
• The
visible and decisive support and commitment of all management levels with the
Directorate at the helm.
• Obtain
knowledge of the protection needs of information assets based on the
application of security risk management.
